MCP connector
For developers
Endpoint
One endpoint, Streamable HTTP, stateless. Every request is a POST; there is no session to establish and no server-sent-event stream to hold open.
https://mcp.siftstock.com/mcpThe four read tools work anonymously. download_image and check_account need an access token bound to a SiftStock account.
Because responses are always JSON, we accept Accept: application/json on its own, and a request with no Accept header at all. The MCP spec has clients send application/json, text/event-stream and conformant ones do — but refusing a caller over a media type this server never emits helps nobody. A client that accepts neither still gets a 406.
Getting a token
SiftStock is its own OAuth 2.1 authorization server. Both discovery documents are served from the connector's origin:
https://mcp.siftstock.com/.well-known/oauth-authorization-serverhttps://mcp.siftstock.com/.well-known/oauth-protected-resourceThe protected-resource document is also served at the path-inserted form, /.well-known/oauth-protected-resource/mcp, for clients that build the URL that way.
- Dynamic client registration is supported, so a client can register itself and does not need credentials issued by hand.
- PKCE is mandatory and S256-only. A request without a code challenge, or with a plain one, is rejected.
- There is one scope:
mcp. - No client secret is ever issued — every registered client is a public client.
Between those two, a conformant client needs no setup on our side: Claude, ChatGPT in developer mode, the Gemini CLI and MCP-capable editors all discover the endpoints and register themselves. See the overview for where each one's “add a connector” box lives.
The handshake
Call a gated tool without a token and the server answers 401 with a WWW-Authenticate header naming the protected-resource document. That header is the entry point: read it, fetch the metadata, register if you need to, and run the authorization-code flow. A conformant MCP client does all of this for you.
The authorization step happens in a browser on siftstock.com, where the account holder sees your client's registered name and approves or denies. Refresh tokens rotate on every use.
Self-hosted agents
Nothing special is required. A self-hosted agent that speaks Streamable HTTP and can run the OAuth flow connects like any other client — and because search, previews, similar images and categories are all anonymous, it can be useful before it has authenticated at all. Only downloading needs a token.
OpenClaw, for example, discovers everything it needs from the endpoint. The scope is mcp:
{"mcp":{"servers":{"siftstock":{"url":"https://mcp.siftstock.com/mcp","transport":"streamable-http","auth":"oauth","oauth":{"scope":"mcp"}}}}}Then openclaw mcp login siftstock to authorize. The authorization step opens a browser on siftstock.com; a loopback redirect (http://localhost or http://127.0.0.1) is accepted for exactly this reason, so command-line and headless clients can complete it.
Rate limits
Limits apply, to anonymous and authenticated callers alike. Back off on a 429 and you will stay well clear of them; a rate-limited caller stays limited for the rest of the current window. We deliberately do not publish the exact numbers here — they are tuned operationally, and a figure on this page would go stale without anyone noticing.